Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    26/05/2024, 03:50

General

  • Target

    2024-05-26_aa44caf6478289043774feece217573a_cryptolocker.exe

  • Size

    36KB

  • MD5

    aa44caf6478289043774feece217573a

  • SHA1

    dd454faf4f6f8f5e4d374ac4213274ca38ddf8f8

  • SHA256

    1fce562d33b6ed2fd5e6afe4cf856bfcc21e679ba8d7344527a530a233697ae5

  • SHA512

    b6cdfd8114e26061f2bb56df0b6960c688c6a2fa210b06dd7178d05e3f4c55fca7afc610586d84b812018afdffd24b7cbd1caec51a8151e9f24969dd051b9c9f

  • SSDEEP

    384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4l8tFFxE2B0qZ5at:btB9g/WItCSsAGjX7r3BTZ52

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-26_aa44caf6478289043774feece217573a_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-26_aa44caf6478289043774feece217573a_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2980
    • C:\Users\Admin\AppData\Local\Temp\gewos.exe
      "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2548

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\gewos.exe

          Filesize

          36KB

          MD5

          d046b310113223544a59c64b46e2721a

          SHA1

          30850ef625daacf9f55539f51f248cd31dc7a477

          SHA256

          24b1d02f70ecf999693bf5e2225bd642ff5bab6ac6c78931f1e1d50306c79f1b

          SHA512

          bb93247e5518e5e8b263cb5124eec3a1478c0393ecb818bd1d5bb3b3803a3e9ab235439758337e90e9f907b9bac566fe47062bc171993286596c0ed1d08e183d

        • memory/2548-23-0x0000000000380000-0x0000000000386000-memory.dmp

          Filesize

          24KB

        • memory/2980-0-0x00000000005A0000-0x00000000005A6000-memory.dmp

          Filesize

          24KB

        • memory/2980-1-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/2980-8-0x00000000005A0000-0x00000000005A6000-memory.dmp

          Filesize

          24KB